Overview
APIs should return 400 for validation errors, 404 for missing resources, 409 for conflicts, and 500 only for unexpected failures. HTML MVC apps use custom error pages with appropriate codes.
Clients and monitors rely on status codes for retry logic.
Implementation
ASP.NET Core: middleware catches exceptions and sets context.Response.StatusCode. Use IExceptionHandler or ProblemDetails. MVC: [ResponseCache] and HandleErrorAttribute with HttpException httpCode.
Log 500 details server-side; return safe bodies to clients.
When implementing guidance from HTTP Status Code in case of Exception, start in a controlled environment that mirrors production versions of operating systems, runtimes, and network policies. Capture a baseline before changes: export configs, snapshot VMs, or tag releases in source control so rollback stays straightforward if behavior regresses.
Document prerequisites, expected outcomes, and verification steps in a short runbook. Automated checks—smoke tests, health endpoints, or query validations—catch regressions early when platforms receive patches. Security belongs in every workflow: apply least privilege, rotate secrets, and review audit logs after deployment.
If results differ across machines, compare environment variables, permission models, time zones, and regional settings. Intermittent issues often trace to caching layers, stale DNS, or duplicated services bound to the same port.
Example
app.UseExceptionHandler(err => {
err.Run(async ctx => {
ctx.Response.StatusCode = StatusCodes.Status500InternalServerError;
await ctx.Response.WriteAsJsonAsync(new { error = "Internal error" });
});
});Tips
- Do not leak stack traces in production.
- Use 401 vs 403 correctly.
- 429 for rate limits.
- Integrate with Application Insights.
- Re-verify after reboots, certificate renewals, or failover exercises.
- Align monitoring and alerts with the failure modes described in this guide.
- Keep vendor documentation links handy for breaking changes between versions.
- Pair automation with a manual spot check during initial production rollout.